Date: Mon, 29 Jul 2002 01:33:21 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Guy Helmer <ghelmer@palisadesys.com> Cc: Song Bo Run <song@rdsk.net>, freebsd-net@FreeBSD.ORG Subject: Re: Crashes in fxp driver with polling enabled Message-ID: <20020729013321.C38758@iguana.icir.org> In-Reply-To: <FPEBKMIFGFHCGLLKBLMMCEPJCAAA.ghelmer@palisadesys.com>; from ghelmer@palisadesys.com on Tue, Jul 16, 2002 at 08:52:02AM -0500 References: <3D33B8C6.2FF275F1@rdsk.net> <FPEBKMIFGFHCGLLKBLMMCEPJCAAA.ghelmer@palisadesys.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jul 16, 2002 at 08:52:02AM -0500, Guy Helmer wrote:
> On Tuesday, July 16, 2002 1:10 AM, Song Bo Run [mailto:song@rdsk.net] wrote:
> > Hello, Guy
> >
> > Here we are encountering almost exactly the same problem as you are,
> > except that we are using OpenBSD. We have ported Luigi's polling code
> > to OpenBSD 2.9 and are using fxp driver. Our testing attack is just ping
> > -f with 65500 bytes data.
could you try the following patch and see if it
fixes the problem ? I have tested it on a few boxes which failed
without it and they can sustain the attack with this patch.
cheers
luigi
Index: if_fxp.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/fxp/if_fxp.c,v
retrieving revision 1.110.2.22
diff -u -b -w -r1.110.2.22 if_fxp.c
--- if_fxp.c 9 Jul 2002 00:37:42 -0000 1.110.2.22
+++ if_fxp.c 29 Jul 2002 07:56:50 -0000
@@ -245,6 +245,9 @@
DRIVER_MODULE(if_fxp, cardbus, fxp_driver, fxp_devclass, 0, 0);
DRIVER_MODULE(miibus, fxp, miibus_driver, miibus_devclass, 0, 0);
+static int fxp_rnr;
+SYSCTL_INT(_hw, OID_AUTO, fxp_rnr, CTLFLAG_RW, &fxp_rnr,0,"fxp rnr events");
+
/*
* Inline function to copy a 16-bit aligned 32-bit quantity.
*/
@@ -1268,10 +1271,20 @@
* Process receiver interrupts. If a no-resource (RNR)
* condition exists, get whatever packets we can and
* re-start the receiver.
+ * When using polling, we do not process the list to completion,
+ * so when we get an RNR interrupt we must defer the restart
+ * until we hit the last buffer with the C bit set.
+ * If we run out of cycles and rfa_headm has the C bit set,
+ * record the pending RNR in an unused status bit, so that the
+ * info will be used in the subsequent polling cycle.
*/
if (statack & (FXP_SCB_STATACK_FR | FXP_SCB_STATACK_RNR)) {
struct mbuf *m;
struct fxp_rfa *rfa;
+ int rnr = (statack & FXP_SCB_STATACK_RNR) ? 1 : 0;
+
+ if (rnr)
+ fxp_rnr++;
rcvloop:
m = sc->rfa_headm;
rfa = (struct fxp_rfa *)(m->m_ext.ext_buf +
@@ -1281,6 +1294,9 @@
if (count < 0 || count-- > 0)
#endif /* DEVICE_POLLING */
if (rfa->rfa_status & FXP_RFA_STATUS_C) {
+#define FXP_RFA_RNRMARK 0x4000 /* used to mark a pending RNR intr */
+ if (rfa->rfa_status & FXP_RFA_RNRMARK)
+ rnr = 1;
/*
* Remove first packet from the chain.
*/
@@ -1328,7 +1344,10 @@
}
goto rcvloop;
}
- if (statack & FXP_SCB_STATACK_RNR) {
+ if (rnr) {
+ if (rfa->rfa_status & FXP_RFA_STATUS_C)
+ rfa->rfa_status |= FXP_RFA_RNRMARK;
+ else {
fxp_scb_wait(sc);
CSR_WRITE_4(sc, FXP_CSR_SCB_GENERAL,
vtophys(sc->rfa_headm->m_ext.ext_buf) +
@@ -1336,6 +1355,7 @@
fxp_scb_cmd(sc, FXP_SCB_COMMAND_RU_START);
}
}
+ }
}
/*
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020729013321.C38758>